[Filder driver 2K/XP] How can we konw when new volume is mounted

Hi,
I am developing a filter driver for monitoring file activity on Windows 2K.
I have derived my driver based on filemon driver from sysinternals web site.
I attach a filter to each available volume/driver letter when my driver loads.
But when new driver letter is mapped to some folder say network driver or
an external device, I am not able to monitor the file activity over these
newly created drivers which are created after my driver is loaded.

Is there any mechanism from where I can know that new driver is
mapped so that I can notify my driver to attach a filter device to the same?

I am also not able to montior CD driver/floppy driver properly. I want a
to know inside a driver or even an application that new disk is inserted and
accepted so that I will have to agian attach a filter over those drivers.

Any help?

Regards,
Satish.
Get Your Private, Free E-mail from Indiatimes at http://email.indiatimes.com
Buy the best in Movies at http://www.videos.indiatimes.com
Bid for Air Tickets @ Re.1 on Air Sahara Flights. Just log on to http://airsahara.indiatimes.com and Bid Now !

filemon only attaches to the current set of mounted drives’ devices.

if u want to dynamically attach to mounted drives as they appear or disappear, u will have to attach ur filter driver to the file system devices first and handle IRP_MJ_FILE_SYSTEM_CONTROL with IRP_MN_MOUNT_VOLUME.

there is only 1 device to attach for microsoft network drives. all drive mappings actually go thru that device. so drive mapping changes will not affect the attachment.

CDs and floppies is also handled as mounted drives.

for more info, u can look at Windows NT File System Internals from Rajeev Nagar.

Ampsi

----- Original Message -----
From: ntfsd
To: File Systems Developers
Sent: Thursday, February 06, 2003 2:46 PM
Subject: [ntfsd] [Filder driver 2K/XP] How can we konw when new volume is mounted

Hi,
I am developing a filter driver for monitoring file activity on Windows 2K.
I have derived my driver based on filemon driver from sysinternals web site.
I attach a filter to each available volume/driver letter when my driver loads.
But when new driver letter is mapped to some folder say network driver or
an external device, I am not able to monitor the file activity over these
newly created drivers which are created after my driver is loaded.

Is there any mechanism from where I can know that new driver is
mapped so that I can notify my driver to attach a filter device to the same?

I am also not able to montior CD driver/floppy driver properly. I want a
to know inside a driver or even an application that new disk is inserted and
accepted so that I will have to agian attach a filter over those drivers.

Any help?

Regards,
Satish.


Get Your Private, Free E-mail from Indiatimes at http://email.indiatimes.com
Buy the best in Movies at http://www.videos.indiatimes.com
Bid for Air Tickets @ Re.1 on Air Sahara Flights. Just log on to http://airsahara.indiatimes.com and Bid Now ! — You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg To unsubscribe send a blank email to xxxxx@lists.osr.com